This question already has an answer here:
Skip to the fifth paragraph for the actual question, before that is some background.
I am a highschool student with an interest in computers and penetration testing. Given the restrictions placed on student-level access on the computers at my school, I often attempt privilege escalation in order to gain more complete access to resources that I need (at times school-related, but restricted nonetheless). Although I do that type of stuff pretty often, I never really expect any major success.
A while ago I was taken aback to discover a local admin account without a password, but that did not provide access to anything I couldn't already access, with the exception of the C:\ drive and tools such as the Task Manager and Command Prompt. In other words: it was far from a big discovery for me.
More recently, I stumbled upon a Fuzzy Security post-exploitation/privilege escalation tutorial (here) which mentioned looking for sensitive data in config files left behind by automated desktop setup. I know from quite a bit of searching that the 513 computers on the schools network have been set up in this way. I was still surprised to find the network admin password in plaintext in C:\sysprep\unattend.xml.
Since finding it, I have further investigated what can be done. The things I have found range from accessing all student and teacher files (which, in some cases include exams and exam keys) to remotely connecting to the school server and the district server to add users as students, teachers, admins, and staff, and modify said users' netlogon files to cause them to run malicious programs when they log on. Much of this I have investigated but not tested for fear of being caught.
My question is whether or not I should tell the school tech staff before someone who would abuse it finds it, and if so, how to go about doing so in a way that wouldn't result in my punishment. My worry is that if I report it, evidence of my explorations of network admin capabilities will appear malicious to them. I want to do the right thing, but I would rather not get in trouble if that's what would happen as a result.